Hello everyone, I've been encountering some unusual behavior with my Postfix setup lately and could really use some assistance. For the past week, I've been noticing strange messages in the Postfix logs, and there seems to be an issue with the transport of mail to .ru domains. However, all other domains (.com to .ru, .ru to .com, Gmail, biz, net, etc.) are functioning correctly. I've thoroughly checked all the A, MX, SPF, and DMARC records, and they are configured correctly. Additionally, the DNS settings appear to be accurate. Domains related to the mail server can successfully send emails to each other without any issues. In the Postfix logs, I'm seeing warnings like: ``` warning: Unable to look up MX host for adc-tech.ru: Host not found, try again warning: Unable to look up MX host for adcpro.ru: Host not found, try again ``` And messages like: `4663960EEC: to=, relay=none, delay=8479, delays=8471/0.04/8/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=yandex.ru type=MX: Host not found, try again)` and very often like this: `NOQUEUE: reject: RCPT from unknown[185.79.119.4]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=` However, when I use nslookup from the same machine where the Mailcow installation resides, all records resolve perfectly. I've ensured that all necessary ports are open and traceroutes are successful. Could anyone please provide some guidance on where else I can look into to resolve this issue? Thank you in advance for your help!

Unbound container does the DNS resolution. Therefore you must allow port 53 outgoing for UDP **and** TCP. Sometimes issues arise due to not completely finished IPv6 configuration. If in doubt try to disable IPv6

@"esackbauer"#p15602 https://docs.mailcow.email/post_installation/firststeps-disable_ipv6/#__tabbed_1_2 i made this but had no luck. ports are opened too ``` Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:995 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:7654 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:18983 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:587 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:110 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:143 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:465 0.0.0.0:* LISTEN tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:19991 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:13306 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:4190 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:993 0.0.0.0:* LISTEN udp 0 0 127.0.0.53:53 0.0.0.0:* ``` any other ideas? still getting `brainpitcher@yandex.ru (Host or domain name not found. Name service error for name=yandex.ru type=MX: Host not found, try again)` and every email to ru based domains except my own on this sever goes to deffered

Strange things with ru based domains

maddler

did you check if that actually resolves from within the ubound container?

Brainpitcher

maddler
everything up and running

b3981229356a:/# nc -zv a.root-servers.net 53
bash: b3981229356a:/#: No such file or directory
b3981229356a:/# nc -zv a.root-servers.net 53
a.root-servers.net (198.41.0.4:53) open
b3981229356a:/# nc -zv b.root-servers.net 53
b.root-servers.net (170.247.170.2:53) open
b3981229356a:/# nc -zvu a.root-servers.net 53
a.root-servers.net (198.41.0.4:53) open
b3981229356a:/# nc -zvu b.root-servers.net 53
b.root-servers.net (170.247.170.2:53) open

but the problem still with me

docker exec -it mailcowdockerized-unbound-mailcow-1 /bin/bash

esackbauer

Brainpitcher ports are opened too

These are the inbound ports, not the outbound ports. Check if you can reach those root servers via TCP on port 53:
https://www.iana.org/domains/root/servers

maddler

TCP and UDP.

maddler

check the actual result of the resolution.
dig +trace MX adc-tech.ru might give you a hint of where things aren’t working

Brainpitcher

maddler

smth strange with ipv6 but ipv4 is fine

b3981229356a:/# dig +trace MX adc-tech.ru

; <<>> DiG 9.18.19 <<>> +trace MX adc-tech.ru
;; global options: +cmd
.                       87203   IN      NS      a.root-servers.net.
.                       87203   IN      NS      b.root-servers.net.
.                       87203   IN      NS      c.root-servers.net.
.                       87203   IN      NS      d.root-servers.net.
.                       87203   IN      NS      e.root-servers.net.
.                       87203   IN      NS      f.root-servers.net.
.                       87203   IN      NS      g.root-servers.net.
.                       87203   IN      NS      h.root-servers.net.
.                       87203   IN      NS      i.root-servers.net.
.                       87203   IN      NS      j.root-servers.net.
.                       87203   IN      NS      k.root-servers.net.
.                       87203   IN      NS      l.root-servers.net.
.                       87203   IN      NS      m.root-servers.net.
;; Received 262 bytes from 127.0.0.11#53(127.0.0.11) in 16 ms

;; UDP setup with 2001:503:c27::2:30#53(2001:503:c27::2:30) for adc-tech.ru failed: network unreachable.
;; UDP setup with 2001:503:c27::2:30#53(2001:503:c27::2:30) for adc-tech.ru failed: network unreachable.
;; UDP setup with 2001:503:c27::2:30#53(2001:503:c27::2:30) for adc-tech.ru failed: network unreachable.
;; UDP setup with 2001:500:a8::e#53(2001:500:a8::e) for adc-tech.ru failed: network unreachable.
ru.                     172800  IN      NS      a.dns.ripn.net.
ru.                     172800  IN      NS      b.dns.ripn.net.
ru.                     172800  IN      NS      d.dns.ripn.net.
ru.                     172800  IN      NS      e.dns.ripn.net.
ru.                     172800  IN      NS      f.dns.ripn.net.
ru.                     86400   IN      DS      43786 8 2 3C59747544090BC74419D5F69E32D8C9B18EA48CBDAA33C094356191 20CED431
ru.                     86400   IN      RRSIG   DS 8 1 86400 20240520050000 20240507040000 5613 . aQLskH74TDpvXUMuyDSF9SQfqZbZWQJV+kS1MbmDEO//yVINBxPSEIlv jNT+LTRDwVWkPsPE5bWS+RXRo+8Wl1TDpjIgk6VgEUnCaUIBTRBSs7kC PvVrn21wKVdLJAE4T0hwqoMWuTmzvNRLMTgvMnC5TEDeTx/EB+UYq5Ol W0NggbsaYAwfJGlyof7S7yrj4C4mhDVaBQapACVj/yO9srirUyzElZE5 bK/TJqy4z0ANy92yD7A3D8exiDzAkAI91h46uEcMwc1FSIWp0sbwT8mr hwamtRPcQtZoce7NFkTGwQWcA6eMhJkwPGgYYzRI3iwQyx7i9R399WA1 74TD9g==
;; Received 687 bytes from 170.247.170.2#53(b.root-servers.net) in 68 ms

;; UDP setup with 2001:678:14:0:193:232:156:17#53(2001:678:14:0:193:232:156:17) for adc-tech.ru failed: network unreachable.
adc-tech.ru.            345600  IN      NS      kyree.ns.cloudflare.com.
adc-tech.ru.            345600  IN      NS      naomi.ns.cloudflare.com.
j20c0qkdhua3cumnkst289ff06u2sq91.ru. 3600 IN NSEC3 1 1 0 - J21C11SHOOTMOEQKPRM91C8AGL4886M6 NS SOA RRSIG DNSKEY NSEC3PARAM
j20c0qkdhua3cumnkst289ff06u2sq91.ru. 3600 IN RRSIG NSEC3 8 2 3600 20240527024952 20240417081859 50208 ru. bsKPvJsATvuczfHDu6g5Yh+cK6o/09z2VVVhBZuquxBUyRG50Zmcuk2M rOMKZbET9/HZN+ZryrEB3HLpZh9+85ISQvWPR7p1eFPrpPhNaGofucgS 8ACThvmO9ku63AudabHb9il5YPa1rkR9E3e8Q8axbGkRrKrP4sSvdBDu w0s=
1019infe5nljf1nkh8d3cjesf4j9s78h.ru. 3600 IN NSEC3 1 1 0 - 10G84QM6AGOTDTP15C5CAORNRRLM8N3J NS DS RRSIG
1019infe5nljf1nkh8d3cjesf4j9s78h.ru. 3600 IN RRSIG NSEC3 8 2 3600 20240525000603 20240417081859 50208 ru. mC7ay4UmUlyHkp5mlWNsN28QXqClElRp9iPMPmo7EzY4RharLdKNSrlW Lbd7Y36wMkyzi7qMX0bDwDLHmzSKZh7YM2P+0cC/qAuyAlel1VQs/8Cz vencoGuVZFR7l69Uy+2kwm+Q//1bFeHn80U2rFseVzNUwb99iTnlRynJ Oh4=
;; Received 580 bytes from 194.85.252.62#53(b.dns.ripn.net) in 0 ms

;; UDP setup with 2a06:98c1:50::ac40:23cf#53(2a06:98c1:50::ac40:23cf) for adc-tech.ru failed: network unreachable.
;; UDP setup with 2a06:98c1:50::ac40:20d0#53(2a06:98c1:50::ac40:20d0) for adc-tech.ru failed: network unreachable.
adc-tech.ru.            300     IN      MX      10 mail.adc-tech.ru.
;; Received 77 bytes from 162.159.44.207#53(kyree.ns.cloudflare.com) in 28 ms

this is from the host

; <<>> DiG 9.16.48-Ubuntu <<>> +trace MX adc-tech.ru
;; global options: +cmd
.                       6957    IN      NS      m.root-servers.net.
.                       6957    IN      NS      l.root-servers.net.
.                       6957    IN      NS      k.root-servers.net.
.                       6957    IN      NS      j.root-servers.net.
.                       6957    IN      NS      i.root-servers.net.
.                       6957    IN      NS      h.root-servers.net.
.                       6957    IN      NS      g.root-servers.net.
.                       6957    IN      NS      f.root-servers.net.
.                       6957    IN      NS      e.root-servers.net.
.                       6957    IN      NS      d.root-servers.net.
.                       6957    IN      NS      c.root-servers.net.
.                       6957    IN      NS      b.root-servers.net.
.                       6957    IN      NS      a.root-servers.net.
;; Received 262 bytes from 127.0.0.53#53(127.0.0.53) in 0 ms

ru.                     172800  IN      NS      a.dns.ripn.net.
ru.                     172800  IN      NS      b.dns.ripn.net.
ru.                     172800  IN      NS      d.dns.ripn.net.
ru.                     172800  IN      NS      e.dns.ripn.net.
ru.                     172800  IN      NS      f.dns.ripn.net.
ru.                     86400   IN      DS      43786 8 2 3C59747544090BC74419D5F69E32D8C9B18EA48CBDAA33C094356191 20CED431
ru.                     86400   IN      RRSIG   DS 8 1 86400 20240520050000 20240507040000 5613 . aQLskH74TDpvXUMuyDSF9SQfqZbZWQJV+kS1MbmDEO//yVINBxPSEIlv jNT+LTRDwVWkPsPE5bWS+RXRo+8Wl1TDpjIgk6VgEUnCaUIBTRBSs7kC PvVrn21wKVdLJAE4T0hwqoMWuTmzvNRLMTgvMnC5TEDeTx/EB+UYq5Ol W0NggbsaYAwfJGlyof7S7yrj4C4mhDVaBQapACVj/yO9srirUyzElZE5 bK/TJqy4z0ANy92yD7A3D8exiDzAkAI91h46uEcMwc1FSIWp0sbwT8mr hwamtRPcQtZoce7NFkTGwQWcA6eMhJkwPGgYYzRI3iwQyx7i9R399WA1 74TD9g==
;; Received 687 bytes from 192.203.230.10#53(e.root-servers.net) in 80 ms

adc-tech.ru.            345600  IN      NS      kyree.ns.cloudflare.com.
adc-tech.ru.            345600  IN      NS      naomi.ns.cloudflare.com.
j20c0qkdhua3cumnkst289ff06u2sq91.ru. 3600 IN NSEC3 1 1 0 - J21C11SHOOTMOEQKPRM91C8AGL4886M6 NS SOA RRSIG DNSKEY NSEC3PARAM
j20c0qkdhua3cumnkst289ff06u2sq91.ru. 3600 IN RRSIG NSEC3 8 2 3600 20240527024952 20240417081859 50208 ru. bsKPvJsATvuczfHDu6g5Yh+cK6o/09z2VVVhBZuquxBUyRG50Zmcuk2M rOMKZbET9/HZN+ZryrEB3HLpZh9+85ISQvWPR7p1eFPrpPhNaGofucgS 8ACThvmO9ku63AudabHb9il5YPa1rkR9E3e8Q8axbGkRrKrP4sSvdBDu w0s=
1019infe5nljf1nkh8d3cjesf4j9s78h.ru. 3600 IN NSEC3 1 1 0 - 10G84QM6AGOTDTP15C5CAORNRRLM8N3J NS DS RRSIG
1019infe5nljf1nkh8d3cjesf4j9s78h.ru. 3600 IN RRSIG NSEC3 8 2 3600 20240525000603 20240417081859 50208 ru. mC7ay4UmUlyHkp5mlWNsN28QXqClElRp9iPMPmo7EzY4RharLdKNSrlW Lbd7Y36wMkyzi7qMX0bDwDLHmzSKZh7YM2P+0cC/qAuyAlel1VQs/8Cz vencoGuVZFR7l69Uy+2kwm+Q//1bFeHn80U2rFseVzNUwb99iTnlRynJ Oh4=
;; Received 580 bytes from 193.232.156.17#53(f.dns.ripn.net) in 108 ms

adc-tech.ru.            300     IN      MX      10 mail.adc-tech.ru.
;; Received 77 bytes from 162.159.44.207#53(kyree.ns.cloudflare.com) in 28 ms

everything is good, but….

esackbauer

Brainpitcher (2a06:98c1:50::ac40:23cf) for adc-tech.ru failed: network unreachable.

maddler

uh, weird

Brainpitcher

maddler

yeap.. i tryed to check from Austria and few Russian cities and other providers - everything is good

; <<>> DiG 9.16.48-Ubuntu <<>> +trace MX adc-tech.ru
;; global options: +cmd
.                       517081  IN      NS      a.root-servers.net.
.                       517081  IN      NS      b.root-servers.net.
.                       517081  IN      NS      c.root-servers.net.
.                       517081  IN      NS      d.root-servers.net.
.                       517081  IN      NS      e.root-servers.net.
.                       517081  IN      NS      f.root-servers.net.
.                       517081  IN      NS      g.root-servers.net.
.                       517081  IN      NS      h.root-servers.net.
.                       517081  IN      NS      i.root-servers.net.
.                       517081  IN      NS      j.root-servers.net.
.                       517081  IN      NS      k.root-servers.net.
.                       517081  IN      NS      l.root-servers.net.
.                       517081  IN      NS      m.root-servers.net.
.                       517081  IN      RRSIG   NS 8 0 518400 20240520050000 20240507040000 5613 . A3Ig3V4ghEl81TWRfz68wP2JGZPOCnOlx0hFr2FsGQUrvb2FJl81c5RP 1TqLwcQ5p3a1wfrb9R9szo+RprFLMDC0NARHc8u6IyGwULwaAit5eSb+ uwoRqvrCqN/PsDW6in3eWcL5dMLgl1WPXuvKY3B9tTKwc1ao45B7Q8zp ibPDpASry/i2JHOxAgcNV2EO7o3pU1SCgOcNmH/ua8OgB8kKnb3BdALa 5iqYEAm8sExcAsbnFVCVXSi2CV5UHXNLJuUFCawY/gAOCb55k/0R4BwX OyGyLvbs2pMm1XSVdJxDT895OAyKVI1Fi/MwJpAPXcrP2MhYJn7lEX5V bECm5Q==
;; Received 525 bytes from 1.1.1.1#53(1.1.1.1) in 16 ms

ru.                     172800  IN      NS      a.dns.ripn.net.
ru.                     172800  IN      NS      b.dns.ripn.net.
ru.                     172800  IN      NS      d.dns.ripn.net.
ru.                     172800  IN      NS      e.dns.ripn.net.
ru.                     172800  IN      NS      f.dns.ripn.net.
ru.                     86400   IN      DS      43786 8 2 3C59747544090BC74419D5F69E32D8C9B18EA48CBDAA33C094356191 20CED431
ru.                     86400   IN      RRSIG   DS 8 1 86400 20240520050000 20240507040000 5613 . aQLskH74TDpvXUMuyDSF9SQfqZbZWQJV+kS1MbmDEO//yVINBxPSEIlv jNT+LTRDwVWkPsPE5bWS+RXRo+8Wl1TDpjIgk6VgEUnCaUIBTRBSs7kC PvVrn21wKVdLJAE4T0hwqoMWuTmzvNRLMTgvMnC5TEDeTx/EB+UYq5Ol W0NggbsaYAwfJGlyof7S7yrj4C4mhDVaBQapACVj/yO9srirUyzElZE5 bK/TJqy4z0ANy92yD7A3D8exiDzAkAI91h46uEcMwc1FSIWp0sbwT8mr hwamtRPcQtZoce7NFkTGwQWcA6eMhJkwPGgYYzRI3iwQyx7i9R399WA1 74TD9g==
;; Received 687 bytes from 192.203.230.10#53(e.root-servers.net) in 184 ms

ADC-TECH.RU.            345600  IN      NS      kyree.ns.cloudflare.com.
ADC-TECH.RU.            345600  IN      NS      naomi.ns.cloudflare.com.
J20C0QKDHUA3CUMNKST289FF06U2SQ91.ru. 3600 IN NSEC3 1 1 0 - J21C11SHOOTMOEQKPRM91C8AGL4886M6 NS SOA RRSIG DNSKEY NSEC3PARAM
J20C0QKDHUA3CUMNKST289FF06U2SQ91.ru. 3600 IN RRSIG NSEC3 8 2 3600 20240527024952 20240417081859 50208 ru. bsKPvJsATvuczfHDu6g5Yh+cK6o/09z2VVVhBZuquxBUyRG50Zmcuk2M rOMKZbET9/HZN+ZryrEB3HLpZh9+85ISQvWPR7p1eFPrpPhNaGofucgS 8ACThvmO9ku63AudabHb9il5YPa1rkR9E3e8Q8axbGkRrKrP4sSvdBDu w0s=
1019INFE5NLJF1NKH8D3CJESF4J9S78H.ru. 3600 IN NSEC3 1 1 0 - 10G84QM6AGOTDTP15C5CAORNRRLM8N3J NS DS RRSIG
1019INFE5NLJF1NKH8D3CJESF4J9S78H.ru. 3600 IN RRSIG NSEC3 8 2 3600 20240525000603 20240417081859 50208 ru. mC7ay4UmUlyHkp5mlWNsN28QXqClElRp9iPMPmo7EzY4RharLdKNSrlW Lbd7Y36wMkyzi7qMX0bDwDLHmzSKZh7YM2P+0cC/qAuyAlel1VQs/8Cz vencoGuVZFR7l69Uy+2kwm+Q//1bFeHn80U2rFseVzNUwb99iTnlRynJ Oh4=
;; Received 591 bytes from 194.85.252.62#53(b.dns.ripn.net) in 52 ms

adc-tech.ru.            300     IN      MX      10 mail.adc-tech.ru.
;; Received 77 bytes from 162.159.44.207#53(kyree.ns.cloudflare.com) in 20 ms

even with windows and ps

DEBUG: 72136

Name                                     Type   TTL   Section    NameExchange                              Preference
----                                     ----   ---   -------    ------------                              ----------
adc-tech.ru                              MX     186   Answer     mail.adc-tech.ru                          10

Name      : .
QueryType : NS
TTL       : 78661
Section   : Authority
NameHost  : c.root-servers.net


Name      : .
QueryType : NS
TTL       : 78661
Section   : Authority
NameHost  : d.root-servers.net


Name      : .
QueryType : NS
TTL       : 78661
Section   : Authority
NameHost  : e.root-servers.net

what am i doing wrong?
The most strangest thing it is that i didn’t do any changes for years - except os upgrades

esackbauer

Could it be that port 53 outbound is only allowed for IPv4, but not for IPv6?

Brainpitcher

esackbauer i turned off ipv6 as you suggested before

should i try to turn ipv6 on?

esackbauer

Brainpitcher should i try to turn ipv6 on?

Yes, please try. Could be that unbound still tries to contact IPv6 servers.

Brainpitcher

esackbauer I will give it a try, but i am still curious why only ru domains?
ru to com works flawlessly

maddler

IPv4 seems to be resolving, can’t see why IPv6 failing would be a problem. But, yes, that’s strange this only happens to .ru domains.

Brainpitcher

ipv6 - not succeed
add new public ip - not succeed
restart - not succeed

this is very close but the only cure it gives is restart and it didn’t work for me

my vm hoster does not see any issues with dns

any new ideas?

Sub-7

The following pages helped me a lot, удачи:

https://www.learndmarc.com
https://www.checktls.com/TestReceiver
https://internet.nl/mail/adc-tech.ru/1235525